CVE-2026-28385: canonical lxd Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-28385 is a medium (CVSS 5.0) Server-Side Request Forgery (SSRF) vulnerability in canonical lxd. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-06-2026
   PublishedVulnerability first disclosed.
2. 26-06-2026
   Last modifiedVulnerability information updated.

Description

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound destination IP addresses, allowing connections to loopback, RFC1918 private ranges, and cloud metadata endpoints. This enables error-based port scanning and unauthorized interaction with internal HTTP services from the daemon's network position.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.